What the AI SAFE² Framework is.
AI SAFE² is a governance and security framework for autonomous and agentic AI systems, authored and published by Cyber Strategy Institute. Version 3.1 defines 161 controls across five operational pillars and a Cross-Pillar Governance layer, CP.1 through CP.10.
The framework tells organizations what must be governed, what must be enforced, and what evidence must exist when AI systems access data, use tools, delegate work or act autonomously.
Where frameworks such as NIST AI RMF and ISO/IEC 42001 describe the outcomes of responsible AI governance, AI SAFE² provides operational controls organizations can implement, test and document.
What version 3.1 actually contains
+
AI SAFE² v3.1 contains 161 framework controls: 151 controls across five operational pillars, plus 10 Cross-Pillar Governance controls, CP.1 through CP.10.
The five pillars govern input protection, auditability, fail-safe behavior, monitoring and continuous improvement. The Cross-Pillar layer governs risks that move between those areas, including agent identity, delegated authority, human responsibility, agent replication and tool access.
Version 3.1 adds stronger governance for the three paths through which an AI agent can act:
- Agent to model provider
- Agent to another agent
- Agent to a tool or MCP server
It also expands the CP.5.MCP security profile from 13 to 19 profile-level sub-controls. These additions strengthen how tool access, authorization, identity, returned content and protocol behavior are governed. They do not increase the overall framework total beyond 161 controls.
Who it is built for
+
Organizations that already have AI in production and cannot yet prove they govern it: CISOs answering board questions, compliance leaders facing an audit with no AI evidence, and the platform teams running agents against live systems today. If your agents can already act on production data, the framework applies to you now — not at your next planning cycle. It also applies to organizations preparing to give AI systems access to business data, software tools, customer workflows or production environments.
How agents are classified — Agent Capability Tiers
+
An Agent Capability Tier (ACT) classifies an AI agent by what it is actually capable of doing — not by how it is described in a design document. Control obligations scale to the tier, so a read-only assistant is not governed like an agent that can move money or change infrastructure. The more an AI system can change, spend, publish, deploy or delegate, the stronger its required controls become.
For ACT-3 and ACT-4, CP.10 requires that human authority over consequential actions be cryptographically verified at the execution boundary — not assumed, and not recorded after the fact.
How you measure where you stand
+
The AI Sovereignty Maturity Score (AISM) places an organization on a five-step scale, so “are we governed?” becomes a number a board can track quarter over quarter. ACT describes the capability and potential impact of an AI system. AISM describes how mature the organization is at governing it.
- Framework
- AI SAFE² v3.1
- Author
- Cyber Strategy Institute
- Structure
- 151 pillar controls + 10 Cross-Pillar controls = 161 total
- Mapped to
- 32+ frameworks
- Maturity scale
- AISM S0–S4
- Licence
- Framework documentation: CC BY-SA 4.0
Code: MIT unless otherwise designated
Five Pillars. One Governance Layer. 161 Controls.
Cross-Pillar Governance connects the five pillars and governs risks that span the entire AI system, including capability tiering, identity, delegated authority, tool and protocol security, agent replication and named human responsibility.
Controls that Traditional Governance Frameworks Rarely make Explicit.
The Cross-Pillar Governance layer adds 10 controls that address the questions no other framework has answered yet.
Who authorized that sub-agent?
CP.9 enforces lineage control over agent spawning. Every sub-agent must inherit authorization from its parent chain and declare its own ACT tier. Unauthorized replication is prevented, not logged.
Explicit agent lineage and replication governanceHuman authority, enforced by architecture.
Human Execution Authority and Responsibility. CP.10 requires that for ACT-3 and ACT-4 systems, human authority is not assumed — it is cryptographically verified at the execution boundary before consequential actions complete.
Named human authority for consequential AI actionsS0 to S4: Where does your organization stand?
The AI Sovereignty Maturity Score gives boards and CISOs a quantitative answer to "how well do we govern our AI?" S0 = no controls. S4 = deterministic enforcement at every execution boundary. Measurable. Auditable. Board-ready.
Integrated · Maps to all 32 compliance frameworksWho authorized that tool call?
AI agents increasingly act through external tools and MCP servers. CP.5.MCP governs which tools an agent can reach, what authority it carries, whether the tool and its catalog can be trusted, and how returned content is inspected before it re-enters the AI system.
19 MCP security sub-controls · Agent-to-tool enforcement Explore AI SAFE² for MCP →32 Frameworks, Mapped to the Controls that Satisfy Them.
AI SAFE² mappings help organizations connect implementation evidence to multiple standards. A mapping supports evidence reuse but does not, by itself, establish certification or regulatory compliance.
Download full crosswalk PDF (email only) →Common Questions, Straight Answers.
What is the AI SAFE² framework?
+
AI SAFE² is a governance framework for autonomous AI systems, authored by Cyber Strategy Institute. Version 3.1 contains 161 controls: 151 across five pillars plus ten Cross-Pillar Governance controls (CP.1–CP.10), mapped to more than 32 regulatory frameworks including ISO/IEC 42001, NIST AI RMF, the EU AI Act, SOC 2 and CMMC 2.0. Its purpose is singular: move an organization from written policy to operational control of the AI actually running in its environment.
How is AI SAFE² different from NIST AI RMF or ISO/IEC 42001?
+
NIST AI RMF and ISO/IEC 42001 describe what good AI governance should achieve; AI SAFE² specifies the enforceable controls that produce it and crosswalks each one back to those standards, so the work you do here generates the evidence they ask for. It also covers two areas neither addresses: agent replication lineage (CP.9) and cryptographic verification of human authority at the execution boundary (CP.10, the HEAR Doctrine). Version 3.1 also governs the three paths through which agents act: toward model providers, toward other agents and toward external tools. AI SAFE² defines the required controls and evidence. NEXUS is Cyber Strategy Institute’s reference implementation, but organizations may use another implementation that satisfies the same control requirements.
What is an Agent Capability Tier (ACT)?
+
An Agent Capability Tier (ACT) classifies an AI agent by what it is capable of doing, from ACT-1 (read-only, low consequence) through ACT-4 (autonomous, consequential, externally facing). Control obligations scale with the tier, and ACT-3 and ACT-4 systems must satisfy the HEAR Doctrine before a consequential action completes.
What is the HEAR Doctrine?
+
HEAR stands for Human Execution Authority and Responsibility. It requires that for ACT-3 and ACT-4 systems, human authority is cryptographically verified at the execution boundary rather than inferred from a workflow approval — closing the gap where an agent acts under authority nobody can prove was granted.
How do we know where our AI governance stands today?
+
The AI Sovereignty Maturity Score (AISM) places an organization on an S0–S4 scale, where S0 means no controls and S4 means deterministic enforcement at every execution boundary. Cyber Strategy Institute’s free assessment takes 8 minutes, requires no call, and returns an initial exposure score with your top three control gaps.
How has AI SAFE² evolved?
+
AI SAFE² has expanded as AI systems have gained more ability to act:
Each release builds on the previous version. Version 3.1 is the current framework and includes the controls introduced in earlier releases.
Is AI SAFE² free to use?
+
The framework is published openly and can be referenced and cited with attribution to Cyber Strategy Institute. AI SAFE² framework documentation is available under CC BY-SA 4.0. Code assets are generally available under the MIT License unless a component specifies another license. Some reference implementations, including designated NEXUS components, use Apache 2.0. The implementation toolkit — audit scorecard, roadmap, policy template and Risk Command Center guide — is available above, and developers can run the controls live via the AI SAFE² MCP server.
Where do we start?
+
Baseline first: the free AI governance assessment takes 8 minutes and no call is required. From there the toolkit turns your specific gaps into an implementation plan, and a Strategic Certainty Session produces a board-ready brief.
Explore open AI SAFE² validation experiments →
Download the AI SAFE² Implementation Toolkit
The AI SAFE² implementation package — audit scorecard, roadmap, enterprise policy template and Risk Command Center guide. v3.1-aligned materials are being incorporated.
Download the Toolkit →Fork on GitHub
161 open framework controls, implementation examples, validation experiments and security tools. Review, test, adapt and contribute.
Framework documentation: CC BY-SA 4.0 · Code: MIT unless otherwise designated
Schedule an AI SAFE² Governance Assessment
90 minutes with Vincent Sullivan. Board-ready risk visualization. Implementation roadmap. $2,500.
Book the Assessment →